CVE-2021-27912

Name of the Vulnerable Software and Affected Versions: Mautic versions prior to 3.3.4 Mautic versions prior to 4.0.0

Description: The issue allows for an inline JS XSS attack when viewing Mautic assets. This is achieved by utilizing inline JS in the title and adding a broken image URL as a remote asset. The attack can only be leveraged by an authenticated user with permission to create or edit assets.

Recommendations: Upgrade to version 3.3.4 or 4.0.0 to resolve the issue. As a temporary workaround, consider restricting access to create or edit assets to minimize the risk of exploitation.